7 ms·

Google Counsel to Arrington Allegation: We Don’t Snoop on Gmail to Find Leakers

74 points by ghosh 13y ago

sc68cal 13y ago
Just like they denied they had no knowledge of PRISM or any other NSA programs? They got awful quiet about that when the NSA started saying that Google and other companies knew what the NSA was doing. So, Google has already demonstrated that they will do or say anything so that people continue sharing and storing personal information on Google servers.
- aniket_ray 13y ago
  And it turned out that Google was correct. Guardian backtracked on their original story and changed the story to NSA surreptitiously stealing user information rather than claiming tech companies were complicit. In response, Google enhanced encryption to further protect users.
  - sc68cal 13y ago
    Here is the full update: "• This article was amended on 20 March 2014 to remove statements in the original that the testimony by Rajesh De contradicted denials by technology companies about their knowledge of NSA data collection. It was also updated to clarify that the companies challenged the secrecy surrounding Section 702 orders. Other minor clarifications were also made." They may have updated their article to excise the denials about PRISM - however the water is still muddy regarding the truthfulness of their statements under numerous other programs that the NSA has conducted under other legal authorities like Section 702, Section 215, etc..
    - dannyr 13y ago
      So why did Google just removed http & is now only https? For show?
      - alwaysdoit 13y ago
        http is like the postcard of the internet. By switching to https only, they are requiring you to send them messages in security envelopes rather than postcards.
      - nl 13y ago
        Why does your bank use https? Amongst other things, it makes NSA tapping of fiber in front of their datacenters less useful. It also makes switches that replicate traffic to NSA less useful.
      - skj 13y ago
        No, for improved security. The http/https question is completely irrelevant to the PRISM-complicity question. I'm not sure why you brought it up.
    - massev 13y ago
      Again: no one denied receiving 702 orders, the point of contention about PRISM isn't that entities receiving data requests knew they were receiving them, it's that they grant the government "direct access" which they denied and still deny. That Guardian piece was wrong and ill conceived and in minimizing their backtracking (they didn't even change the headline) they did themselves a disservices: http://www.techdirt.com/articles/20140319/17162326629/dont-fall-misleading-story-being-spread-nsa-suggesting-tech-companies-lied-about-prism.shtml http://www.techdirt.com/articles/20140319/17162326629/dont-f...
adamnemecek 13y ago
Somehow I'm not convinced.
jrlocke 13y ago
"I am not a crook."
deleted 13y ago
[deleted]
comex 13y ago
At the moment, all three top level comments are accusing Google of lying, despite the fact that these kinds of flat denials by high-profile companies are almost never proven false, probably because they almost never are false. (As described elsewhere, PRISM was not such a case.) In this case, the original story was already dubious, and it should be clear that the fallout from being caught lying would be drastically worse than either ignoring the story or being the second to admit to doing something (legal) that Microsoft already admitted to. The fact that the comments exist anyway tends to shake my faith in the rationality of other, more credible criticisms of big companies in this forum.
- jmspring 13y ago
  I've been meaning to look at the trend in reactions to comparable news about google and that about microsoft. My suspicion is counter to your first statement, but very much believes your last.
- trhway 13y ago
  there is a reason executives avoid getting into any details of anything. Just like that Enron CEO "I'm not an accountant". Time for SOX style act for privacy/security area?
  - tptacek 13y ago
    Google didn't avoid details here. Their General Counsel issued a categorical denial not just of Arrington's story, but of the notion that anything like Arrington's story had ever happened in any other circumstance. It is very difficult to argue that they're weaseling. For whatever it's worth, Google is also not Enron. It's not hard to imagine Enron executives saying anything, because Enron was a sham business, "faking it until they made it" or, as it happened, fell off a cliff. Google generates tens of billions of dollars of revenue per year. They have a lot to lose. When Google's General Counsel says something newsworthy, it's not done casually. Finally: I think it's worth reminding people that the other side of this argument is a person who claims not to have reported on this story until a few days ago because --- despite the fact that the story was immensely relevant to the public interest, and despite the fact that not reporting it put his own sources at grave risk not merely of losing their jobs but of being sued by billion dollar companies --- to have reported it earlier would have risked the bottom line of his own publication. Who are you going to believe?
fpgeek 13y ago
Let's put Google's denial off to the side for one moment. The core of Arrington's accusation is broken: "The source had corresponded with me from a non Google email account, so the only way Google saw it was by accessing my Gmail account." No, that's not the only way Google could have seen this email. It could easily have leaked via the non-Google email account: The employee could have (intentionally or accidentally) forwarded the email to their work account. Or they could have sent it or accessed it unencrypted from a Google internal network. They could have also sent the email to someone else who passed it on to Google. And so on. Yes, these are all stupid mistakes that your careful, tech-savvy leaker shouldn't make, but people make mistakes like them all the time. And I wouldn't expect an inebriated leaker to make a point of mentioning whatever stupid mistake they might have made (if said leaker even realized where they went wrong).
- pavanky 13y ago
  > Or they could have sent it or accessed it unencrypted from a Google internal network. This is the most likely scenario. If you are using a shared network administered by someone other than you, you should assume nothing about privacy or secrecy.
- furyg3 13y ago
  I would find it very dubious if my own employer asserted that it was appropriate to read and act on an employee's private, non-work email because that employee accessed it from their network or device. If I were a Google employee I'd be pretty interested in getting answers as to how they acquired this information, and to advocate to change internal policies if this was the case. It also makes me think twice about ever working for an organization where I don't have root on the devices I use.
  - ithkuil 13y ago
    What makes you think that Google employees don't have root on their devices? Are you talking about android specifically?
  - skj 13y ago
    Google employees have root on their devices, unless it's a chromebook pixel for some reason. If you root that you can't use the corp network. Not sure why, since you have root on any other kind of laptop you might get from corp.
ForFreedom 13y ago
Google does not snoop, they just search
brisance 13y ago
The headline is wrong but I wouldn't put it past some rogue Google employee who does have such powers and has abused them. Case in point: David Barksdale, ex-Googler. https://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://gawker.com/5637234/gcreep-google-engineer-stalked-te...
- skj 13y ago
  Such access is highly audited in Google. That audit trail was used as evidence against the person in question here in a criminal trial. (That link isn't working, for whatever reason, so I'm just assuming it's the same case that I'm thinking about)
wudf 13y ago
In tv shows, this would be called plausible deniability.
Maakuth 13y ago
This would be an excellent chance for Google et al. to just drop the permission of them reading Gmail users' e-mail from the terms of service. If they have no intention of doing it, why leave it open in the terms?
- curiouscats 13y ago
  I agree, the lawyer denies it, then says we have the right to do so now and in the future. And adds, though I can't imagine when we ever would. The right to snoop through your email is the problem (the algorithmic searching to place ads I can understand some people finding annoying but that is the bargain for using Gmail - it isn't that I am talking about - it is the snooping for whatever purpose Google has for reading your emails by a person at Google). That you promise to not do what you give yourself the right to do is not worth much of anything. I don't imagine this lawyer would sign off on legal contracts that had bad clauses that the other side said "no, leave the contract the way it is, just trust us to not ever use that clause."
- nl 13y ago
  There maybe cases where they need to read emails for debugging purposes (eg fixing a spam filtering problem). Perhaps this should require explicit permission.
Lambent_Cactus 13y ago
When did we decide that Michael Arrington, of all people, was a credible source for allegations like this in the first place?
jessaustin 13y ago
Stipulating to Arrington's claims for the moment, he doesn't come across as very security-minded. When you're collaborating with a "whistle-blower", the employer is your adversary. Why would anyone use the employer's communication service to collaborate in such a case?
- deleted 13y ago
  [deleted]

74 points by ghosh 13y ago

Just like they denied they had no knowledge of PRISM or any other NSA programs? They got awful quiet about that when the NSA started saying that Google and other companies knew what the NSA was doing. So, Google has already demonstrated that they will do or say anything so that people continue sharing and storing personal information on Google servers.

aniket_ray 13y ago
And it turned out that Google was correct. Guardian backtracked on their original story and changed the story to NSA surreptitiously stealing user information rather than claiming tech companies were complicit. In response, Google enhanced encryption to further protect users.
- sc68cal 13y ago
  Here is the full update: "• This article was amended on 20 March 2014 to remove statements in the original that the testimony by Rajesh De contradicted denials by technology companies about their knowledge of NSA data collection. It was also updated to clarify that the companies challenged the secrecy surrounding Section 702 orders. Other minor clarifications were also made." They may have updated their article to excise the denials about PRISM - however the water is still muddy regarding the truthfulness of their statements under numerous other programs that the NSA has conducted under other legal authorities like Section 702, Section 215, etc..
  - dannyr 13y ago
    So why did Google just removed http & is now only https? For show?
    - alwaysdoit 13y ago
      http is like the postcard of the internet. By switching to https only, they are requiring you to send them messages in security envelopes rather than postcards.
    - nl 13y ago
      Why does your bank use https? Amongst other things, it makes NSA tapping of fiber in front of their datacenters less useful. It also makes switches that replicate traffic to NSA less useful.
    - skj 13y ago
      No, for improved security. The http/https question is completely irrelevant to the PRISM-complicity question. I'm not sure why you brought it up.
  - massev 13y ago
    Again: no one denied receiving 702 orders, the point of contention about PRISM isn't that entities receiving data requests knew they were receiving them, it's that they grant the government "direct access" which they denied and still deny. That Guardian piece was wrong and ill conceived and in minimizing their backtracking (they didn't even change the headline) they did themselves a disservices: http://www.techdirt.com/articles/20140319/17162326629/dont-fall-misleading-story-being-spread-nsa-suggesting-tech-companies-lied-about-prism.shtml http://www.techdirt.com/articles/20140319/17162326629/dont-f...

adamnemecek 13y ago

Somehow I'm not convinced.

jrlocke 13y ago

"I am not a crook."

deleted 13y ago

[deleted]

comex 13y ago

At the moment, all three top level comments are accusing Google of lying, despite the fact that these kinds of flat denials by high-profile companies are almost never proven false, probably because they almost never are false. (As described elsewhere, PRISM was not such a case.) In this case, the original story was already dubious, and it should be clear that the fallout from being caught lying would be drastically worse than either ignoring the story or being the second to admit to doing something (legal) that Microsoft already admitted to. The fact that the comments exist anyway tends to shake my faith in the rationality of other, more credible criticisms of big companies in this forum.

jmspring 13y ago
I've been meaning to look at the trend in reactions to comparable news about google and that about microsoft. My suspicion is counter to your first statement, but very much believes your last.
trhway 13y ago
there is a reason executives avoid getting into any details of anything. Just like that Enron CEO "I'm not an accountant". Time for SOX style act for privacy/security area?
- tptacek 13y ago
  Google didn't avoid details here. Their General Counsel issued a categorical denial not just of Arrington's story, but of the notion that anything like Arrington's story had ever happened in any other circumstance. It is very difficult to argue that they're weaseling. For whatever it's worth, Google is also not Enron. It's not hard to imagine Enron executives saying anything, because Enron was a sham business, "faking it until they made it" or, as it happened, fell off a cliff. Google generates tens of billions of dollars of revenue per year. They have a lot to lose. When Google's General Counsel says something newsworthy, it's not done casually. Finally: I think it's worth reminding people that the other side of this argument is a person who claims not to have reported on this story until a few days ago because --- despite the fact that the story was immensely relevant to the public interest, and despite the fact that not reporting it put his own sources at grave risk not merely of losing their jobs but of being sued by billion dollar companies --- to have reported it earlier would have risked the bottom line of his own publication. Who are you going to believe?

fpgeek 13y ago

Let's put Google's denial off to the side for one moment. The core of Arrington's accusation is broken: "The source had corresponded with me from a non Google email account, so the only way Google saw it was by accessing my Gmail account." No, that's not the only way Google could have seen this email. It could easily have leaked via the non-Google email account: The employee could have (intentionally or accidentally) forwarded the email to their work account. Or they could have sent it or accessed it unencrypted from a Google internal network. They could have also sent the email to someone else who passed it on to Google. And so on. Yes, these are all stupid mistakes that your careful, tech-savvy leaker shouldn't make, but people make mistakes like them all the time. And I wouldn't expect an inebriated leaker to make a point of mentioning whatever stupid mistake they might have made (if said leaker even realized where they went wrong).

pavanky 13y ago
> Or they could have sent it or accessed it unencrypted from a Google internal network. This is the most likely scenario. If you are using a shared network administered by someone other than you, you should assume nothing about privacy or secrecy.
furyg3 13y ago
I would find it very dubious if my own employer asserted that it was appropriate to read and act on an employee's private, non-work email because that employee accessed it from their network or device. If I were a Google employee I'd be pretty interested in getting answers as to how they acquired this information, and to advocate to change internal policies if this was the case. It also makes me think twice about ever working for an organization where I don't have root on the devices I use.
- ithkuil 13y ago
  What makes you think that Google employees don't have root on their devices? Are you talking about android specifically?
- skj 13y ago
  Google employees have root on their devices, unless it's a chromebook pixel for some reason. If you root that you can't use the corp network. Not sure why, since you have root on any other kind of laptop you might get from corp.

ForFreedom 13y ago

Google does not snoop, they just search

brisance 13y ago

The headline is wrong but I wouldn't put it past some rogue Google employee who does have such powers and has abused them. Case in point: David Barksdale, ex-Googler. https://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://gawker.com/5637234/gcreep-google-engineer-stalked-te...

skj 13y ago
Such access is highly audited in Google. That audit trail was used as evidence against the person in question here in a criminal trial. (That link isn't working, for whatever reason, so I'm just assuming it's the same case that I'm thinking about)

wudf 13y ago

In tv shows, this would be called plausible deniability.

Maakuth 13y ago

This would be an excellent chance for Google et al. to just drop the permission of them reading Gmail users' e-mail from the terms of service. If they have no intention of doing it, why leave it open in the terms?

curiouscats 13y ago
I agree, the lawyer denies it, then says we have the right to do so now and in the future. And adds, though I can't imagine when we ever would. The right to snoop through your email is the problem (the algorithmic searching to place ads I can understand some people finding annoying but that is the bargain for using Gmail - it isn't that I am talking about - it is the snooping for whatever purpose Google has for reading your emails by a person at Google). That you promise to not do what you give yourself the right to do is not worth much of anything. I don't imagine this lawyer would sign off on legal contracts that had bad clauses that the other side said "no, leave the contract the way it is, just trust us to not ever use that clause."
nl 13y ago
There maybe cases where they need to read emails for debugging purposes (eg fixing a spam filtering problem). Perhaps this should require explicit permission.

Lambent_Cactus 13y ago

When did we decide that Michael Arrington, of all people, was a credible source for allegations like this in the first place?

jessaustin 13y ago

Stipulating to Arrington's claims for the moment, he doesn't come across as very security-minded. When you're collaborating with a "whistle-blower", the employer is your adversary. Why would anyone use the employer's communication service to collaborate in such a case?

deleted 13y ago
[deleted]